vibeqm-check 0.4.2 → 0.4.3

package/README.md

@@ -130,7 +130,7 @@ that caused it. The report appears on the run's summary page.
 ```yaml
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }      # the checks sample history
-- uses: vibeqm/vibeqm-check@v0.4.2
+- uses: vibeqm/vibeqm-check@v0.4.3
   with: { min-level: 2 }        # optional: fail the run below this level
 ```
 

package/dist/src/checks/basics.js

@@ -342,9 +342,30 @@ function environmentsShown(root, files, unfilled = []) {
     }
     return shown;
 }
+/** Claude Code settings files that count as the repository's: committed in HEAD, read as
+ * committed (uncommitted edits are not in any clone). The user's ~/.claude/settings.json
+ * and an uncommitted project file limit this machine only. A file that can't be read
+ * has text null. */
+export function committedSettings(root) {
+    const project = [".claude/settings.json", ".claude/settings.local.json"];
+    const inHead = new Set((git(root, ["ls-tree", "-r", "--name-only", "HEAD", "--", ...project]) ?? "").split("\n").filter(Boolean));
+    const disk = (file) => {
+        try {
+            return readFileSync(file, "utf8");
+        }
+        catch {
+            return null;
+        }
+    };
+    return [
+        ...project.map((f) => (inHead.has(f) ? { file: join(root, f), committed: true, text: git(root, ["show", `HEAD:${f}`]) } : { file: join(root, f), committed: false, text: disk(join(root, f)) })),
+        { file: join(homedir(), ".claude", "settings.json"), committed: false, text: disk(join(homedir(), ".claude", "settings.json")) },
+    ].filter((s) => s.committed || existsSync(s.file));
+}
 /** Where the agent is told, or made, to ask before publishing live. */
 function confirmationRule(root) {
     const found = [];
+    const machineOnly = [];
     const rules = RULES_FILES.filter((f) => existsSync(join(root, f)));
     for (const f of rules) {
         const line = read(root, f)
@@ -353,22 +374,24 @@ function confirmationRule(root) {
         if (line)
             found.push(`${f}: "${line.replace(/^[-*\s]+/, "").trim().slice(0, 100)}"`);
     }
-    const settings = [join(root, ".claude", "settings.json"), join(root, ".claude", "settings.local.json"), join(homedir(), ".claude", "settings.json")];
-    for (const file of settings) {
-        if (!existsSync(file))
-            continue;
+    // Only settings committed to the repository count; this machine's settings are named, not counted.
+    for (const { file, committed, text } of committedSettings(root)) {
         try {
-            const p = JSON.parse(readFileSync(file, "utf8"))?.permissions ?? {};
+            const p = JSON.parse(text ?? "")?.permissions ?? {};
             const hits = [...(p.ask ?? []), ...(p.deny ?? [])].filter((x) => typeof x === "string" && /^Bash\(/.test(x) && DEPLOY_COMMAND.test(x));
-            const where = file.startsWith(homedir()) && !file.startsWith(root) ? `${file} (this machine's settings, not the repository's)` : file.slice(root.length + 1);
-            if (hits.length)
-                found.push(`publish commands that stop for the person or are refused in ${where}: ${hits.slice(0, 3).join(", ")}${hits.length > 3 ? "…" : ""}`);
+            if (!hits.length)
+                continue;
+            const list = `${hits.slice(0, 3).join(", ")}${hits.length > 3 ? "…" : ""}`;
+            if (committed)
+                found.push(`publish commands that stop for the person or are refused in ${file.slice(root.length + 1)}: ${list}`);
+            else
+                machineOnly.push(`${file} (this machine's settings, not committed): ${list}`);
         }
         catch {
             /* unreadable settings: agentPermissions reports it */
         }
     }
-    return found;
+    return { found, machineOnly };
 }
 export function devApartFromProd(root) {
     const gate = "Development apart from production";
@@ -377,13 +400,13 @@ export function devApartFromProd(root) {
     const envs = environmentsShown(root, files, unfilled);
     // "<the live address, or "nothing is live yet">" is a template's choice, not a statement.
     const notLive = [...RULES_FILES, "README.md"].map((f) => read(root, f).split("\n").find((l) => NOT_LIVE.test(l) && !placeholders(l).length)).find(Boolean);
-    const confirm = confirmationRule(root);
+    const { found: confirm, machineOnly } = confirmationRule(root);
     const shownEnvs = envs.length ? envs : notLive ? [`not live yet: "${notLive.trim().slice(0, 80)}"`] : [];
     const ev = [
         shownEnvs.length
             ? `environments: ${shownEnvs.slice(0, 2).join("; ")}`
             : `no development and production environments named in the repository (in the rules file, the README or a note) or shown by config files${unfilled.length ? `: ${unfilled[0]}` : ""}`,
-        confirm.length ? `confirmation before publishing live: ${confirm.slice(0, 2).join("; ")}` : "no rule that the agent publishes live only after the person confirms (a line in the rules file, or an ask or deny rule on publish commands in the agent's settings)",
+        confirm.length ? `confirmation before publishing live: ${confirm.slice(0, 2).join("; ")}` : `no rule that the agent publishes live only after the person confirms (a line in the rules file, or an ask or deny rule on publish commands in the agent's settings committed to the repository)${machineOnly.length ? `; found only in ${machineOnly[0]}, which other clones and CI don't have` : ""}`,
     ].join("; ");
     return r(2, gate, shownEnvs.length && confirm.length ? "met" : "not-met", ev);
 }

package/dist/src/checks/level2.js

@@ -1,11 +1,10 @@
 // Level 2 (Guarded) fact checks, from ASSESSOR.md v0.3 §2. Judgment questions are
 // left to the AI assessor; this file only reports what a script can prove.
 import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
-import { homedir } from "node:os";
 import { join, relative } from "node:path";
 import { commitSizes, git, median } from "../git.js";
 import { defaultBranchRuns, mergedPullRequests } from "../host.js";
-import { blanksNote, CHECK_COMMANDS, code, delegated, placeholders, RULES_FILES } from "./basics.js";
+import { blanksNote, CHECK_COMMANDS, code, committedSettings, delegated, placeholders, RULES_FILES } from "./basics.js";
 const SMALL_BATCH_LIMIT = 400; // ASSESSOR §2: median changed lines per merged change
 const SAMPLE = 100;
 export function agentRulesFile(root) {
@@ -144,42 +143,38 @@ export function ownerPerChange(root) {
             : `all ${authors.length} sampled commits have a human author: ${[...people].slice(0, 3).join(", ")}${agentWritten ? `; ${agentWritten} of them written with an AI agent (per their trailers), owned by that author` : ""}`,
     };
 }
-/** Claude Code deny rules or a sandbox, in the project or the user's settings. */
+/** Claude Code deny rules or a sandbox, in settings committed to the repository. */
 export function agentPermissions(root) {
     const gate = "Agent permissions";
-    const sources = [
-        join(root, ".claude", "settings.json"),
-        join(root, ".claude", "settings.local.json"),
-        join(homedir(), ".claude", "settings.json"),
-    ];
     const found = [];
+    const machine = [];
     const unreadable = [];
-    for (const file of sources) {
-        if (!existsSync(file))
-            continue;
+    for (const { file, committed, text } of committedSettings(root)) {
         try {
-            const s = JSON.parse(readFileSync(file, "utf8"));
+            const s = JSON.parse(text ?? "");
             const deny = s?.permissions?.deny ?? [];
-            const where = file.startsWith(homedir()) && !file.startsWith(root) ? `${file} (this machine's settings, not the repository's: other clones and CI don't have them)` : file;
+            const into = committed ? found : machine;
             if (deny.length)
-                found.push(`${deny.length} deny rules in ${where}`);
+                into.push(`${deny.length} deny rules in ${file}`);
             if (s?.sandbox?.enabled)
-                found.push(`sandbox enabled in ${where}`);
+                into.push(`sandbox enabled in ${file}`);
         }
         catch {
             unreadable.push(`unreadable settings: ${file}`);
         }
     }
     if (!found.length) {
+        // Limits on this machine are real here, but clones and CI don't have them: a person can attest them.
+        const local = machine.length ? [`${machine.join("; ")}: this machine's settings, not committed, so other clones and CI don't have them; commit .claude/settings.json, or attach proof that every machine working on this repository has them`] : [];
         return {
             level: 2,
             gate,
             status: "not-visible",
             // An unreadable file is not a limit: it says so, and never meets the gate.
-            evidence: [...unreadable, "no Claude Code deny rules or sandbox found; other agents' settings are not read yet. Attach proof of limits"].join("; "),
+            evidence: [...unreadable, ...local, ...(local.length ? [] : ["no Claude Code deny rules or sandbox committed; other agents' settings are not read yet. Attach proof of limits"])].join("; "),
         };
     }
-    return { level: 2, gate, status: "met", evidence: [...found, ...unreadable].join("; ") };
+    return { level: 2, gate, status: "met", evidence: [...found, ...machine.map((m) => `also ${m} (this machine only)`), ...unreadable].join("; ") };
 }
 /** A CI run on the default branch that failed, then a later run of the same workflow
  * that passed: the checks refused a change and it was fixed. */

package/dist/src/fixes.js

@@ -205,7 +205,7 @@ const FIXES = {
     "Agent permissions": () => ({
         why: "An agent that can run anything can delete, leak or force-push anything.",
         steps: [
-            'Add deny rules to `.claude/settings.json` (or the user\'s `~/.claude/settings.json`): `"permissions": {"deny": ["Bash(git push --force*)", "Bash(git push -f*)", "Bash(git commit --no-verify*)", "Bash(rm -rf /*)", "Bash(rm -rf ~*)", "Read(./.env*)", "Read(**/.env*)"]}`, plus the paths of any credentials this project uses.',
+            'Add deny rules to `.claude/settings.json` and commit it (the user\'s `~/.claude/settings.json` limits one machine only; clones and CI don\'t have it): `"permissions": {"deny": ["Bash(git push --force*)", "Bash(git push -f*)", "Bash(git commit --no-verify*)", "Bash(rm -rf /*)", "Bash(rm -rf ~*)", "Read(./.env*)", "Read(**/.env*)"]}`, plus the paths of any credentials this project uses.',
             "Keep production credentials and secrets out of the agent's environment.",
         ],
         verify: "Try one denied command (e.g. `git commit --no-verify --dry-run`) and confirm it is refused. " + RERUN,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibeqm-check",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Self-assessment for the Vibe Quality Model (VibeQM): fact checks on a repository, with evidence for every gate",
   "keywords": [
     "vibe-quality-model",

package/templates/level-2/.claude/settings.json

@@ -15,7 +15,7 @@
       "Bash(git push * --delete*)",
       "Bash(git push -d *)",
       "Bash(git push * -d *)",
-      "Bash(git push * :*)",
+      "Bash(git push * :**)",
       "Bash(rm -rf /*)",
       "Bash(rm -rf ~*)",
       "Bash(rm -rf ..*)",